DOVE 3.2 FEDRAMP Revised PWS.pdf

1.0 GENERAL

1.1 BACKGROUND

The Volunteer Delivery System (VDS) consists of the agency’s core business processes and supporting technology that enable the Peace Corps to fill requests of host countries with suitable Volunteers. The VDS supports two programs that have different staff and associated workflows:

Peace Corps Volunteers and Peace Corps Response.

For both programs, the VDS begins with the formulation of project frameworks specific to each host country that define the particular skills and number of Volunteers that need to be successfully recruited and placed by the Peace Corps for varying lengths of service. The VDS ends when the Volunteer departs for their country of service. The VDS is a true production environment with production quotas (a specific number of Volunteers for specific volunteer jobs is requested and delivered by established deadlines for varying lengths of service). It is a human resource processing system through which involved offices must work interactively.

The VDS needs technology to support those business processes that process candidates from the time they apply until they begin their service overseas. The current VDS process is outlined in Table 1 below.

Table 1- Current VDS Process Components

VDS Business Process Component Staff Systems (Interconnections)

GENERATE DEMAND: Overseas staff create jobs that are posted on the Peace Corps website. Leads are generated and managed.

● Office Based Recruiters

● Field Based Recruiters

● Public Affairs

Specialists

● Peace Corps Response

(PCR) Recruiters

● PCrm (Peace Corps Recruitment and Marketing Application)Dynamics Customer relationship management (CRM))

● Peace Corps website

● BrassRing Talent

Gateway

● Infinite BrassRing

APPLY: Candidates for Volunteer service apply through a web-based form.

After they complete the application, candidates are directed to complete a Health History Form (HHF) (hosted by Peace Corps in MAXx (Peace Corps’ pre-service medical system)) to capture their current medical history.

● BrassRing Talent Gateway

● MAXx (Peace Corps’ pre-service medical system)

EVALUATE and INVITE:

Applications are evaluated and suitable

● Placement Officers

● PCR Recruiters

● Infinite BrassRing

● HireVue Coordinate

VDS Business Process Component Staff Systems (Interconnections) candidates are interviewed and invited to be Volunteers in a specific country and program.

CLEARANCE: After a candidate has accepted their invitation, they are reviewed for a final legal and medical clearance.

● Medical Staff

● Legal Eligibility Staff

● MAXx

● Infinite BrassRing

ONBOARD: After a candidate has accepted their invitation, they are directed to complete their onboarding paperwork, review training materials, and report to a pre-departure orientation event known as a ‘staging’ before boarding a plane to their country of service.

● Staging

● Country Desk Officers

● PCR Recruiters

● Infinite Onboard

● LearningSpace (Peace

Corps’ Learning Management System)

1.2 SCOPE

The Contractor shall support the currently utilized cloud-based technology solution to support the following components. These components are in the current VDS solution based on Infinite Talent Acquisition Suite:

a. Job opportunities presentation layer: Mobile and web-enabled module that allows Peace Corps staff to create jobs, vet them through an approval process, and use an Application Programming Interface (API) to post them to the Peace Corps website.

b. Online application portal: Mobile and web-enabled platform that allows individuals to complete an application, attach supporting documentation, and track their progress using a single 508-compliant log-in for the entire candidate experience. This portal should integrate with www.peacecorps.gov (which is maintained by Peace Corps staff) and be consistent with the design for peacecorps.gov.

c. Candidate Workflow and Assessment: Back-end admin module with lifecycle workflow processing to track candidates’ personal data and qualifications, search for qualified candidates based on certain criteria, score candidates based on various assessment tools used throughout the process,and communicate with candidates and other external users (references). Support multiple workflows based on volunteer type.

d. Analytics and Reporting: Dashboards that track progress toward goals by predetermined criteria (sector/skill category, country, availability date, qualification summary, time in application process, number of applicants from various schools, etc.); data import/export capabilities.

e. Candidate Onboarding: Ability for candidates to use a candidate portal to complete required documentation (insurance forms, releases, financial etc.) and receive content specific to their volunteer position.

f. Integrations and APIs: Ability to transfer data in format(s) determined by Peace Corps staff between the vendor-provided system and systems inside and outside of Peace Corps (e.g., send an update regarding a candidate’s medical clearance status from MAXx to the candidate’s record in vendor-provided system). Support inbound and outbound integrations.

The period of performance for this contract is a base period of one year and four additional optional periods of one year each. The total period of performance if all optional periods are exercised will be five years.

1.3 OBJECTIVE

The desired goal is the continued licensing and support of the Peace Corps VDS. Peace Corps requires the use of Infinite BrassRing and Infinite Onboard which are part of the Infinite Talent Acquisition Suite products from Infinite Computer Solutions.

This system supports candidates from the time when they search for Volunteer jobs/positions through filling out an application, the assessment and placement process, and finally through an onboarding process. Therefore, the Agency requires:

a. A configurable, Software as a Service (SaaS) solution.

i. Must integrate with Peace Corps existing infrastructure and several downstream financial and information systems;

ii. Must comply with the security requirements of the Peace Corps (see attachment

Appendix A and section 5.2); and

iii. Must provide software hosting and support services via a Service Level Agreement

(SLA).

b. Seamless transition. The solution shall enable Peace Corps to conduct a seamless and expedited transition from the current contract with Incident Command System? (ICS) to the proposed contract with minimal disruption to business operations while ensuring data integrity.

2.0 PERFORMANCE REQUIREMENTS

2.1 VDS SOLUTION

The Contractor shall license and support the Volunteer Delivery System (VDS) solution according to the Peace Corps requirements, specifications, and business guidelines herein.

2.1.1 The Contractor shall host and support the currently implemented VDS solution that supports the application, processing, and onboarding processes associated to selecting volunteers. This solution is based on the Infinite Talent Suite. The Contractor shall manage, support, and provide technical project management and oversight testing through deployment of any updates or changes to the product.

2.1.2 The Contractor shall provide support resources to assist with support and maintenance of all functions within the VDS solution.

2.1.3 The Contractor shall provide software license(s) and provide annual software and hardware support for the VDS solution. Contractor must provide a detailed Service Level Agreement (SLA) (i.e., Maintenance and Support Agreement) as part of its technical quote. Issue resolution shall be in accordance with the stated SLA timeframes during Contract performance.

2.1.3.1 The Contractor shall provide technical support and maintenance services that include monitoring of reported issues, classification of issues, triaging of issues with request/problem tracking through to resolution, and general helpdesk assistance for the life of the contract.

2.1.3.2 The software license shall include all fixes, patches, and updates. The contractor shall provide Peace Corps implementation team the ability to implement fixes, patches, and product updates to the system.

2.1.4 The Contractor shall develop and maintain an effective quality control program to ensure services are performed in accordance with this PWS.

2.1.4.1 The Contractor shall develop and implement procedures to identify, prevent, and ensure non-recurrence of defective services.

2.1.4.2 The Contractor shall meet physical and information security safeguard standards.

2.1.4.3 The Contractor shall make available upon request of the CO or COR, a record of inspections. The records must be kept and made available to the Peace Corps, when requested, throughout the contract performance period and for the period after contract completion until final settlement of any claims, if any, under this contract.

2.1.4.4 Any problems or concerns regarding quality assurance should be outlined in writing to the COR. The COR will discuss any issues with the Contractor.

Records of all inspections conducted by the Contractor and corrective action taken shall be made available to the Peace Corps upon request.

2.1.5 Security Compliance

2.1.5.1 The contractor shall comply with Peace Corps “Information Security Program Requirements” Policy (see attachment Appendix A) and section 5.2 “Cloud Information Systems – IT Security and Privacy Requirements.”

2..1.5.2 The Contractor shall comply with the Federal Information Processing Standards (FIPS), the “Special Publications 800 series” guidelines published by NIST, and the requirements of the Federal Information Security Modernization Act (FISMA).Scope

2.2 ENGINEERING SERVICES

The Peace Corps anticipates that the VDS Contractor will provide new features and functionality in future releases that will be beneficial and desirable by the agency. The Contractor will execute tasks specified by Technical Instructions approved by the COR that may include, but is not limited to, analysis and implementation of additional and/or new VDS related features and functions. The COR will approve these tasks specified in Technical Instructions to ensure that they fall within the scope of the contract and that there is available funding for the tasks.

2.2.1 The engineering services shall be performed within the limits, if any, as to place(s) and period(s) specified as authorized by the Contracting Officer’s Representative (COR) via Technical Instructions (TI). Each TI issued shall be in accordance with section 2.3 “Technical Instructions” and Attachment 3 “Technical Instruction Template.”

2.2.2 When authorized, the Contractor’s employees shall perform engineering services in accordance with the Technical Instructions. However, the Contractor’s employees shall not be considered employees of the Government.

2.2.3 The maximum liability of the Government for each engineering services line item shall not exceed the amount set forth in the Schedule, or the amount obligated, whichever is less. If, at any time, the Contractor has reason to believe that the amounts it expects to incur in the performance of each engineering services line item in the next succeeding sixty (60) days, when added to all amounts previously incurred, will exceed seventy-five percent (75%) of the amount set forth in the Schedule; or if, at any time, the Contractor has reason to believe that the full performance of each engineering services requirement will be greater than or less than that set forth in the Schedule, the Contractor shall notify the Contracting Officer (CO) in writing, giving its revised estimate of the performance of said item. The Contractor shall not exceed the obligated amount for each engineering services line item, unless and until such amount has been increased in writing by the CO.

2.2.4 In the event the Government does not designate time(s) and place(s) sufficient for performance of the total quantity of engineering services line items set forth in the Schedule within the period(s) provided therefor, those services/deliveries not furnished shall be deemed to be terminated for the convenience of the Government at no cost to the Government. Such termination shall be evidenced by a written document signed by the Contracting Officer and mailed or otherwise furnished to the contractor.

2.2.5 Engineering support services may be required for the following areas:

2.2.5.1 Contractor may be asked to create a presentation layer that is above and beyond existing functionality to include a single portal for all components of the candidate experience from application through onboarding.

2.2.5.2 Contractor might be asked to develop unique reports that are not met by standard reporting.

2.2.5.3 Contractor might be asked to create integrations with systems outside of the mandatory requirements, which may include the creation of APIs or other methods.

2.2.5.4 Contractor may be requested to extract all Peace Corps related data in agreed upon specified formats to migrate at any time during the period of performance.

2.2.6 Engineering services line items shall not exceed the Not to Exceed (NTE) amount identified in each Technical Instruction (TI). Any revision or increase to the NTE within the TI must be issued with a formal modification to the contract by the Contracting Officer.

2.3 TECHNICAL INSTRUCTIONS

Performance of the work hereunder may be subject to written technical instructions (TIs) signed by the COR specified in this contract.

As used herein, TIs are defined to include the following:

(1) Directions to the Contractor which suggest pursuit of certain lines of inquiry, shift work emphasis, fill in details or otherwise serve to accomplish the contractual requirements for Engineering Services CLINs (X002, X003, etc.).

(2) Guidelines to the Contractor which assist in the interpretation of specifications or technical portions of work description.

TIs must be within the general scope of work stated in the contract. TIs may not be used to:

(1) assign additional work under the contract;

(2) direct a change as defined in the "CHANGES" subsection of clause FAR 52.212-4;

(3) increase or decrease the contract price or estimated contract amount (including fee), as applicable, the level of effort, or the time required for contract performance; or

(4) change any of the terms, conditions or specifications of the contract.

If, in the opinion of the Contractor, any TI calls for effort outside the scope of the contract or is inconsistent with this requirement, the Contractor shall notify the CO in writing within ten (10) working days after the receipt of any such instruction. The Contractor shall not proceed with the work affected by the TI unless and until the Contractor is notified by the CO that the TI is within the scope of this contract.

Nothing in the foregoing paragraph shall be construed to excuse the Contractor from performing that portion of the contractual work statement which is not affected by the disputed TI.

The Contractor shall inform the COR, in writing, when 75% of the hours allotted to a particular TI have been expended. Expenditures for a TI shall not exceed the allotted amount. This TI is contingent upon the availability of funds and performance shall not commence until funding has been obligated on the contract/order.

The Contractor must propose its best approach for supporting engineering efforts in response to TIs in response to this PWS.

3.0 DELIVERABLES

Table 2- Deliverables

Item No. Deliverable Description Frequency PWS Reference Deliver to Format Due

1 VDS Software license

License for use and support of software supporting current VDS solution through the base or option period

Once per contract period

2.1 VDS Solution COR Software

license

Start of base or option period

2 Quality Control Plan

Description of vendor’s method for managing the solution

Once 2.1.4 COR Document Within 21 days of award

3 Status Report Report documenting status of TIs and past and anticipated service issues or outages

Monthly 2.1 VDS Solution and 2.3 Technical Instructions

COR Work document

First Tuesday of the month

4 Data Extraction Extraction of all Peace Corps related data and documents

Once 2.2.5.4 COR Various as specified in technical instructions

TBDUpon termination of contractt

5 Initial Security Authorization

Package Checklist

Collection of security documentation required to obtain FedRAMP

Authorization (for Agency Review)

Once 5.2.1 Assessment of the System

PMOCOR/

ISSO

Word or PDF Document

Within 90 days of security modification P00002

6 FedRAMP Readiness

Assessment ReviewInitial

Security Assessment

Demonstrates the CSPs overall readiness for FedRAMP authorization3PAO assessment results including Security Assessment Plan

(SAP) and SAR that demonstrates the CSP’s overall readiness for FedRAMP authorization

Once 5.2.2 Authorization of the System

COR Word or PDF Document

Within 120 220 days of security modification P00002

7 FedRAMP In-Process

Demonstrates the CSP is actively working toward a FedRAMP

Authorization with Peace Corps

Once 5.2.2 Authorization of the System

COR FedRAMP Package ID

Within 165 days of security modification P00002

8 FedRAMP Authorized designation

Designation by FedRAMP Program Management Office that the

Contractor’s solution is documented for security assessment.

Once 5.2.2 Authorization of the System, COR FedRAMP Package ID

Within one year of security modification award FedRAMP In-

Process designation 9 Review of continuous monitoring documentation

Documentation of security monitoring.

Includes vulnerability scans, vulnerability mitigation status, plans of action and milestones (POA&M) status, change requests and incidents.

Monthly until FedRAMP Authorization

5.2.3 Reporting and

Continuous Monitoring

COR/ISSO Collection of documents

Beginning upon security modification P00002

10 Personnel Security Package

Collection of documents needed for personnel background checks

As needed for personnel

5.2.4 Personnel Security

Requirements

COR Collection of documents

14 days prior to expected work

11 Privacy Threshold

Assessment

(PTA)

Document if PII is in scope or not in scope of vendor’s cloud solution.

Once 5.2.6.2 Personally Identifiable Information

COR/ISSO Word or PDF Document

Within 30 days of security modification P00002

12 Privacy Impact Assessment

For PII collected, maintained or disseminated in scope of the vendor’s cloud solution.

Once 5.2.6.2 Personally Identifiable Information

COR/ISSO Agency provided template

Within 30 days of security modification P00002

4.0 PERFORMANCE REQUIREMENTS SUMMARY (PRS)

The contractor service requirements are summarized into performance objectives that relate directly to mission essential items. The performance threshold briefly describes the minimum acceptable levels of service required for each requirement. These thresholds are critical to mission success.

Table 3- Performance requirements summary

Service Output Performance Objective Acceptable Quality Level (AQL) Method of Surveillance

VDS Solution VDS solution is functional at all times, except during scheduled maintenance.

VDS services are operational 98% of the time, excluding scheduled maintenance.

Monthly vendor reports of availability, observations and customer complaints

Engineering Services

All required service performed within the specified time requirements.

Contractor meets the specified time requirement 95% of the time.

Periodic surveillance by the COR or government designee and status reports

Quality control program is administered in accordance with documentation

Quality is maintained Contractor is in compliance with QCP

97% of the time

Report reviews, observations and customer complaints

Monthly Reporting

Reports are accurate Contractor provides 100% accurate reports.

Report reviews by the COR, observations and customer complaints

Reports are provided in a timely manner

Contractor provides 90% of monthly reports on time 90% of the time.

Report reviews by the COR

FedRAMP documentation (Deliverables 5, 6, 7 and 8)

Demonstrate continued progress to FedRAMP designation

Contractor provides deliverables within two weeks of the due date

Review by COR/ISSO

Service Output Performance Objective Acceptable Quality Level (AQL) Method of Surveillance

Continuous monitoring response

All discovered vulnerabilities are addressed

100% of vulnerabilities are either corrected or addressed with managed Plans of

Action and Milestones

(POA&M)

Review by the ISSO

5.0 ADDITIONAL CONTRACTOR REQUIREMENTS

5.1 KEY PERSONNEL

The Contractor shall identify staff for positions designated as “Key Personnel.” The Government deems these positions as critical to the performance of work under this contract. Any proposed substitutes for individuals occupying these positions shall possess qualifications equal to or superior to those of the key personnel being replaced. The inability of the Contractor to provide personnel with equal to or superior qualifications of the key personnel may result in termination of the contract. At a minimum, the individuals occupying the positions listed below are considered key personnel for the duration of this contract. The CO may at his/her discretion add to or subtract from this list.

Title Name:

Client Manager Julie Goldberg

All key personnel are subject to the following requirements:

a. Replacement is subject to the prior written approval of the COR.

b. Requests for replacement shall include a detailed resume containing a description of position duties and qualifications, as well as information about the qualifications of the individual(s) proposed and any security clearance(s) held.

c. Contractor proposals to move any key personnel off the contract shall use commercially reasonable efforts to submit such proposals in writing at least thirty (30) days in advance of proposed move, and are subject to the approval of the COR, including approval of proposed replacement.

5.1.1 Client Manager Minimum Roles and Qualifications

The Client Manager shall be responsible for the overall management and coordination of this contract and shall act as the central point of contact with the Peace Corps. The Client Manager shall have full authority to act for the Contractor in the performance of the required services. The Client Manager shall be a single point of contact for the CO and the COR. During any absence of the Client Manager, only one alternate shall have full authority to act for the Contractor on all matters relating to work performed under the Contract. The Client Manager, or a designated representative, shall meet with the COR to discuss problem areas as they occur. The Client Manager or designated representative shall respond consistent with the SLA after notification by the Peace Corps of the existence of a problem. The Client Manager must read, write, and speak English fluently and at a minimum be required to participate in periodic Project Management Reviews.

Minimum qualifications for the Client Manager position include at least five years of experience in project leadership roles involved in successfully supporting large-scale talent management systems with a user base of at least 100 persons. The individual must have extensive knowledge of talent management information applications, relevant industry standards, database management systems, and system management principles.

5.2 CLOUD INFORMATION SYSTEMS – IT SECURITY AND PRIVACY

REQUIREMENTS

The contractor shall implement the controls contained within the FedRAMP Cloud Computing Security Requirements Baseline and FedRAMP Continuous Monitoring Requirements for Moderate impact systems (as defined in FIPS PUB 199). These documents define requirements for compliance to meet minimum Federal information security and privacy requirements for Moderate impact systems. The FedRAMP baseline controls are based on NIST Special Publication 800-53, Revision 5, “Security and Privacy Controls for Federal Information Systems and Organizations”, and also includes a set of additional controls for use within systems providing cloud services to the federal government.

Peace Corps may choose to cancel the contract and terminate any outstanding orders if the contractor has its FedRAMP authorization (Joint Authorization Board [JAB] Provisional or Agency) revoked and the deficiencies are greater than agency risk tolerance thresholds.

5.2.1 Assessment of the System

The contractor shall comply with FedRAMP requirements as mandated by Federal laws and policies, including making available any documentation, physical access, and logical access needed to support this requirement. The Level of Effort for the Assessment and Authorization (A&A) is based on the System’s FIPS PUB 199 categorization. The contractor shall create, maintain and update the following documentation in accordance with the Initial Authorization Package Checklist using FedRAMP requirements and templates, which are available at FedRAMP.gov. (See Appendix B for FedRAMP Initial Authorization Checklist.)

Information systems must be assessed by an accredited FedRAMP Third Party Assessment Organization (3PAO) initially and whenever there is a significant change to the system’s security posture in accordance with the FedRAMP Continuous Monitoring Plan.

The Government reserves the right to perform Security Assessment and Penetration Testing (of its instance). If the Government exercises this right, the contractor shall allow Government employees (or designated third parties) to conduct Security Assessment and Penetration Testing activities to include control reviews in accordance with FedRAMP requirements. Penetration https://www.fedramp.gov/ https://www.fedramp.gov/

Testing shall be supported by mutually agreed upon Rules of Engagement (RoE). Review activities include but are not limited to manual penetration testing; automated scanning of operating systems, web applications; wireless scanning; network device scanning to include routers, switches, and firewall, and IDS/IPS; databases and other applicable systems, including general support structure, that support the processing, transportation, storage, or security of Government information for vulnerabilities.

The contractor shall provide access to the Federal Government, or their designee acting as their agent, when requested, in order to verify compliance with the requirements for an Information Technology security program. The contractor shall make appropriate personnel available for interviews and provide all necessary documentation during this review.

Physical Access Considerations – If the Cloud Service Provider (CSP) is operated within an Infrastructure as a Service (IaaS) that is FedRAMP authorized (e.g., AWS); physical access to the physical datacenter environment will be governed by the terms of access allowed by the underlying infrastructure provider as defined in the FedRAMP A&A authorization package.

Identified gaps between required FedRAMP Security Control Baselines and Continuous Monitoring controls and the contractor's implementation as documented in the Security Assessment Report shall be tracked by the contractor for mitigation in a Plan of Action and Milestones (POA&M) document. Depending on the severity of the gaps, the Government may require them to be remediated before a Peace Corps authorization is issued.

The contractor is responsible for mitigating all security risks found during A&A and continuous monitoring activities. All critical vulnerabilities must be remediated with 7 days, high-risk vulnerabilities must be mitigated within 14 days and all moderate risk vulnerabilities must be mitigated within 45 days from the date vulnerabilities are formally identified in accordance with Peace Corps policy. The Government will determine the risk rating of vulnerabilities.

5.2.2 Authorization of the System

Peace Corps will leverage the CSP’s FedRAMP Assessment and Authorization package to document and assess the customer controls for which Peace Corps has responsibility and issue a Peace Corps ATO for the agency’s instance of the CSP’s SaaS or PaaS offering. The CSP shall work with the Peace Corps to facilitate documentation and assessment of required customer controls, as necessary.

The CSP SaaS offering shall follow the below process to achieve a FedRAMP Authorization:

a. Shall deliver within 120 days of contract award a FedRAMP Readiness Assessment Review completed by a FedRAMP 3PAO following the FedRAMP Readiness Assessment Guidelines.

• The FedRAMP Readiness Assessment Review demonstrates the CSPs overall readiness for FedRAMP authorization and whether it has a viable path to achieve a FedRAMP authorization within one (1) year of the contract modification award.

If the CSP does not provide a FedRAMP Readiness Assessment as prescribed or the assessment demonstrates a significant gap in capabilities that will preclude achievement of a FedRAMP authorization within 1 year of the contract award, then, Peace Corps will terminate the contract.

b. Be listed as FedRAMP Ready on the FedRAMP Marketplace website within 120 days of contract award.

https://marketplace.fedramp.gov/products

c. Be listed as FedRAMP In-Process on the FedRAMP Marketplace website within 165 days of contract award.

https://marketplace.fedramp.gov/products

If requirements a-c, as defined above are met (within 5.5 months of contract award), the CSP will have one (1) year from the date of contract modification award to achieve FedRAMP authorization. During this transitional period, Peace Corps may issue an agency specific authorization (i.e., not FedRAMP) not to exceed one (1) year (to allow the CSP to achieve FedRAMP compliance).

Note: CSPs must comply with all FedRAMP Baseline Controls. Additionally, the CSP shall implement Peace Corps provided specific parameter settings as set forth in the Peace Corps Control Tailoring Workbook.

The CSP shall ensure these essential security controls are implemented and operating as intended.

Further, the CSP shall make the proposed system and security architecture of the information system available to the OCIO security team of assigned Information Security Officers (ISSOs) and Subject Matter Experts (SME) for review and approval before commencement of system build (architecture, infrastructure, and code (as applicable)) and/or the start of A&A in support of the Initial Authorization Package and Continuous Monitoring activities.

5.2.3 Reporting and Continuous Monitoring

Maintenance of the FedRAMP Authorization will be through continuous monitoring and periodic audit of the operational controls within the Contractor’s system, environment, and processes to determine if the security controls in the information system continue to be effective over time in light of changes that occur in the system and environment. Through continuous monitoring, security controls and supporting deliverables are updated in agreement with FedRAMP guidelines and submitted to the repository designated by the FedRAMP program.

The submitted deliverables provide a current understanding of the security state and risk posture of the information systems. The deliverables will allow the Peace Corps to leverage the services providers’ cloud offering to make credible risk-based decisions regarding the continued operations of the information systems and initiate appropriate responses as needed when changes occur. Contractors will be required to provide updated deliverables and automated data feeds as defined in the FedRAMP Continuous Monitoring Plan.

In compliance with the Peace Corps agency specific authorization, on a monthly basis, the Contractors shall in collaboration with the ISSO team, provide access to the required deliverables to ensure the CSP maintains an appropriate risk posture.

The Contractor shall furnish access to the following deliverables:

• Monthly OS, database, and web application, vulnerability scans as specified in the NIST SP 800-53 Control RA-5 parameter in Peace Corps’ Control Tailoring Workbook (deliverable shall include raw results and findings shall be included in the POA&M document);

• Monthly Plan of Action and Milestones (POA&M);

• Change requests (as they occur)

• Incidents (as they occur) Upon achievement of FedRAMP authorization, Peace Corps will accept the FedRAMP A&A and continuous monitoring documentation made available on the repository designated by the FedRAMP program in agreement with FedRAMP guidelines to satisfy the continuous monitoring requirement.

5.2.4 Personnel Security Requirements

Contractor shall furnish documentation reflecting favorable adjudication of background investigations for all personnel (including subcontractors) supporting the system. Peace Corps separates the risk levels for personnel working on Federal computer systems as follows:

• A favorable initial fitness/suitability determination must be granted and a Tier 1 or higher background investigation initiated before access to the Peace Corps network or any Peace Corps IT system. There shall be no waivers to this requirement for Peace Corps network and IT system access for Peace Corps employees or contractors.

• A favorable initial fitness/suitability determination must be granted and a Tier 2 or higher background investigation initiated before access to PII/CUI is granted. The authority and access shall be determined by the appropriate Peace Corps Supervisor (for Peace Corps employees) or CO (for contract personnel), Data Owner, and the System's AO. Each System's AO, with the request of the Peace Corps Supervisor, Data Owner or CO, shall evaluate the risks associated with each such request.

• A favorable suitability determination must be completed at a Tier 2 or higher background investigation before privileged access to the Peace Corps network or IT systems is granted. A waiver may be requested in order to maintain Peace Corps business operations; however such requests should be used judiciously and not incur unnecessary risks to Peace Corps.

If final adjudication of a background investigation is unfavorable, Peace Corps network and IT system access must be revoked, and any GFE, including the Peace Corps PIV card, must be retrieved and returned to OS&S.

Peace Corps shall sponsor the investigation when deemed necessary. No access shall be given to government computer information systems and government sensitive information without a background investigation being verified or in process. If results of background investigation are not acceptable, then access shall be terminated.

The Contractor shall provide a report of separated staff on a monthly basis, beginning 60 days after execution of the option period.

5.2.5 Sensitive Information Storage

Controlled Unclassified Information (CUI) information, data, and/or equipment will only be disclosed to authorized personnel on a need-to-know basis. The contractor shall ensure that appropriate administrative, technical, and physical safeguards are established to ensure the security and confidentiality of this information, data, and/or equipment is properly protected.

When no longer required, this information, data, and/or equipment will be returned to Government control, destroyed, or held until otherwise directed. Destruction of items shall be accomplished by following NIST Special Publication 800-88, “Guidelines for Media Sanitization.” The destruction, purging or clearing of media specific to the CSP will be recorded and supplied upon request of the Government.

5.2.6 Protection of Information

The contractor shall be responsible for properly protecting all information used, gathered, or developed as a result of work under this contract. The contractor shall also protect all Government data, equipment, etc. by treating the information in accordance with its FISMA system categorization.

All information about the systems gathered or created under this contract should be considered as CUI information. If contractor personnel must remove any information from the primary work area that is included in the ATO boundary, they should protect it to the same FedRAMP requirements. The use of any information that is subject to the Privacy Act will be utilized in full accordance with all rules of conduct as applicable to Privacy Act Information.

5.2.6.1 Unrestricted Rights to Data

The government will retain unrestricted rights to government data. The ordering activity retains ownership of any user created/loaded data and applications hosted on vendor’s infrastructure, as well as maintains the right to request full copies of these at any time.

5.2.6.2 Personally Identifiable Information

Personally Identifiable Information (PII) is in the scope of acquisition and PII is expected to be stored in the vendor's cloud solution. The vendor shall prepare a Privacy Threshold Assessment (PTA) to either document PII is not in scope, or determine which categories of information will be stored, processed, or transmitted by the system. The use of any information that is subject to the Privacy Act will be utilized in full accordance with all rules of conduct as applicable to Privacy Act Information.

PII will require the following guidelines be adhered to.

• The vendor’s information system must be authorized at least at the FIPS PUB 199 Moderate level.

• For any system that collects, maintains or disseminates PII, a PIA must be completed by the contractor and provided to the Peace Corps Privacy Office for review along with the other authorization to operate (ATO) documents.

• If the system retrieves information using PII, the Privacy Act applies and it must have a system of records notice (SORN) published in the Federal Register.

• If PII is collected from individuals by the system, a Privacy Act Statement (i.e., Privacy Notice) must be provided to users prior to their use of the application on what data is being collected and why, as well as the authority for the collection and the impact of not providing some or all of it. The Privacy Act Statement must be available to the individual directly on the form used to collect the information. Providing a link back to the Statement from the form is acceptable.

5.2.6.3 Data Availability

The data must be available to the Government upon request within one business day or within the timeframe negotiated with the Contractor, and shall not be used for any other purpose other than that specified herein. The contractor shall provide requested data at no additional cost to the government.

5.2.6.4 Data Release

Any information made available to the Contractor by the Government shall be used only for the purpose of carrying out the provisions of this contract and shall not be divulged or made known in any manner to any persons except as may be necessary in the performance of the contract. In performance of this contract, the Contractor assumes responsibility for protection of the confidentiality of Government records and shall ensure that all work performed by its subcontractors shall be under the supervision of the Contractor or the Contractor’s responsible employees. Each officer or employee of the Contractor or any of its subcontractors to whom any Government record may be made available or disclosed shall be notified in writing by the Contractor that information disclosed to such officer or employee can be used only for that purpose and to the extent authorized herein. Further disclosure of any such information, by any means, for a purpose or to an extent unauthorized herein, may subject the offender to criminal sanctions imposed by 18 U.S.C. §§ 1030.

Contractor will not disclose Customer Data to any government or third party or access or use Customer Data; except in each case as necessary to maintain the Cloud Services or to provide the Cloud Services to Customer in accordance with this contract, or as necessary to comply with the law or a valid and binding order of a governmental or regulatory body (such as a subpoena or court order). Unless it would be in violation of a court order or other legal requirement, Contractor will give Government reasonable notice of any such legal requirement or order, to allow Government to seek a protective order or other appropriate remedy.

5.2.7 Data Ownership

All Government data collected in the system is the property of the Federal Government. All data collected by the system shall be provided by the Contractor (system provider) as requested during the contract period and at the completion of the contract period.

5.2.8 Confidentiality and Nondisclosure

Personnel working on any of the described tasks, may at Government request, be required to sign formal non-disclosure and/or conflict of interest agreements to guarantee the protection and integrity of Government information and documents.

Additionally, any information made available to the Contractor by the Government shall be used only for the purpose of carrying out the provisions of this contract and shall not be divulged or made known in any manner to any persons except as may be necessary in the performance of the contract. In performance of this contract, the Contractor assumes responsibility for protection of the confidentiality of Government records and shall ensure that all work performed by its subcontractors shall be under the supervision of the Contractor or the Contractor’s responsible employees. Each officer or employee of the Contractor or any of its subcontractors to whom any Government record may be made available or disclosed shall be notified in writing by the Contractor that information disclosed to such officer or employee can be used only for that purpose and to the extent authorized herein. Further disclosure of any such information, by any means, for a purpose or to an extent unauthorized herein, may subject the offender to criminal sanctions imposed by 18 U.S.C. §§ 1030.

5.2.9 Peace Corps Non-Disclosure Agreement

Each individual contractor/subcontractor employee who performs work on this contract is required to sign an Employee NDA. The Contractor shall submit to the COR a completed confidentiality and NDA for each individual contractor/subcontractor.

The Contractor and all contractor/subcontractor employees may have access to sensitive data, proprietary, or confidential business information of other companies or the Government in the course of performing official duties on this contract. The term “proprietary information” means any information considered so valuable by its owners that it is held in secret by them and their licensees and is not available to the public.

All information that is (1) obtained related to or derived from this contract, and (2) results from or derived from any actual tasks assigned to contractor employees while participating on this contract is considered proprietary.

The Contractor and all contractor/subcontractor employees will not use vendor proprietary information except as necessary to perform this contract, and shall agree not to disclose such information to third parties, including any employee of the contractor/subcontractor who has not executed this NDA, or use such information in any manner inconsistent with the purpose for which it was obtained. Anyone failing to comply with the agreement may be subject to disciplinary action or termination of employment by the contractor/subcontractor, and possible administrative, civil, or criminal penalties.

Note: Peace Corps’s Office of the General Counsel (OGC) is available to coordinate on defining NDA requirements. Upon request, Peace Corps OGC can advise on NDA development.

5.2.10 Additional Stipulations

Deliverables shall be labeled Controlled Unclassified Information (CUI)or contractor selected designation per document sensitivity. External transmission/dissemination of CUI to or from a Government computer must be encrypted. Certified encryption modules must be used in accordance with FIPS PUB 140-2, “Security Requirements for Cryptographic Modules.”

The Contractor shall certify applications are fully functional and operate correctly as intended on systems using benchmarks from Peace Corps technical guidelines, NIST guidelines, Center for Internet Security guidelines, or industry best practice guidelines, as reviewed and accepted by the Peace Corps AO. The standard installation, operation, maintenance, update, and/or patching of software shall not alter the configuration settings from the approved benchmark configuration.

Information technology for Windows systems should use the Windows Installer Service for installation to the default “program files” directory and should be able to silently install and uninstall. Applications designed for normal end users shall run in the standard user context without elevated system administration privileges. The contractor shall use tools to verify their products operate correctly with the approved benchmark configurations and do not alter the benchmark settings.

The contractor shall cooperate in good faith in defining NDA that other third parties must sign when acting as the Federal government’s agent.

Note: Peace Corps’s Office of the General Counsel (OGC) is available to coordinate on defining NDA requirements. Upon request, Peace Corps OGC can advise on NDA development.

The contractor shall comply with any additional FedRAMP privacy requirements.

The Government has the right to perform manual or automated audits, scans, reviews, or other inspections of the vendor’s IT environment being used to provide or facilitate services for the Government. The Contractor shall be responsible for the following privacy and security safeguards:

a. The Contractor shall not publish or disclose in any manner, without the Contracting Officer’s written consent, the details of any safeguards either designed or developed by the Contractor under this contract or otherwise provided by the Government. Exception - Disclosure to a Consumer Agency for purposes of A&A verification or to the designated FedRAMP portal. To the extent required to carry out a program of inspection to safeguard against threats and hazards to the security, integrity, and confidentiality of Government data, the Contractor shall afford the Government access to the Contractor’s facilities, installations, technical capabilities, operations, documentation, records, and databases within 72 hours of the request. The Contractor shall provide logical access to support incident investigations in accordance with defined FedRAMP Incident Response procedures and/or Peace Corps Incident Response services, shall be provided as soon as possible but not longer than 72 hours after request.

b. Physical Access Considerations – If the SaaS provider is operated within an IaaS that is FedRAMP authorized (e.g., AWS); physical access to the physical datacenter environment will be governed by the terms of access allowed by the underlying infrastructure provider as defined in the FedRAMP A&A authorization package.

c. The program of inspection shall include, but is not limited to:

• Authenticated and unauthenticated operating system/network vulnerability scans

• Authenticated and unauthenticated web application vulnerability scans

• Automated scans can be performed by Government personnel, or agents acting on behalf of the Government, using Government operated equipment, and Government specified tools. If the vendor chooses to run its own automated scans or audits, results from these scans may at the Government’s discretion, be accepted in lieu of Government performed vulnerability scans. In these cases, scanning tools and their configuration shall be approved by the Government. In addition, the results of vendor conducted scans shall be provided in full to the Government.

d. If new or unanticipated threats or hazards are discovered by either the Government or the Contractor, or if existing safeguards have ceased to function, the discoverer shall immediately bring the situation to the attention of the other party.

The Contractor shall comply with Section 1634 of Public Law 115-91 that prohibits use of any hardware, software, or services developed or provided, in whole or in part, by— (1) Kaspersky Lab (or any successor entity); (2) any entity that controls, is controlled by, or is under common control with Kaspersky Lab; or (3) any entity of which Kaspersky Lab has majority ownership.

The Contractor shall comply with 52.204-25 of the Federal Acquisition Regulation (FAR). It prohibits, under Section 889(a)(1)(A) of the John S. McCain National Defense Authorization Act for Fiscal Year 2019 (Pub. L. 115-232), contractors from providing to the Government any equipment, system, or service that uses telecommunications equipment or video surveillance services from certain named companies as a substantial or essential component of any system, or as critical technology as part of any system , unless an exception or waiver is granted per the FAR. It also prohibits, under Section 889(a)(1)(B), contractors from using any equipment, system, or service that uses telecommunications or video surveillance equipment or services from certain named companies as a substantial or essential component of any system or as critical technology as part of any system, unless an exception or waiver is granted per the FAR.

The proscribed companies are Huawei Technologies Company, ZTE Corporation, Hytera Communications Corporation, Hangzhou Hikvision Digital Technology Company, and Dahua Technology Company and their subsidiaries and affiliates.

5.2.11 References

• Guide to Understanding FedRAMP https://www.congress.gov/bill/115th-congress/house-bill/2810/text#toc-HC791755DF28D4E2BA0A5C4418094E922 https://www.congress.gov/bill/115th-congress/house-bill/2810/text#toc-HC791755DF28D4E2BA0A5C4418094E922 https://www.congress.gov/bill/115th-congress/house-bill/2810/text#toc-HC791755DF28D4E2BA0A5C4418094E922 https://s3.amazonaws.com/sitesusa/wp-content/uploads/sites/482/2015/03/Guide-to-Understanding-FedRAMP-v2.0-4.docx

• FedRAMP Cloud Computing Documents

• FedRAMP Templates

5.3 SYSTEM ACCESSIBILITY AND EASE OF USE

Pursuant to Section 508 of the Rehabilitation Act of 1973 (29 U.S.C. 794d) as amended by P.L.

105-220 under Title IV (Rehabilitation Act Amendments of 1998) all Electronic and Information Technology (EIT) developed, procured, maintained and/or used under this contract shall be in compliance with the “Electronic and Information Technology Accessibility Standards” set forth by the Architectural and Transportation…